From mboxrd@z Thu Jan 1 00:00:00 1970 From: Damien Mason Subject: VLANs and DNAT Date: Fri, 25 Jul 2003 09:40:02 +1000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3F206E52.2090307@suse.net.au> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Hi Everyone, I have two interfaces, eth1 and eth2 I have multiple vlans on a eth1, that is, eth1.1 and eth1.2, eth1.3 Eth2 is the external interface to the internet. Vlan1 uses the following network address: 192.168.50.0/24 Vlan2 uses the following network address: 192.168.50.0/24 also Vlan3 uses the following network address: 192.168.10.0/24 I have NAT working for the vlans, that is, clients are able to access the external internet using nat. However, there are servers on Vlan2 which I would like to forward traffic to from the external interface, I would imagine that I could do something like: iptables -A PREROUTING -t nat -p tcp -d 203.221.181.27 --dport 80 -j DNAT --to 192.168.50.10:80 But I cannot specify an interface -i eth1.2 in the prerouting, because it occurs pre-routing? How can I forward traffic to a host on a vlan when the vlans don't use unique addressing schemes?.. I was thinking I may have to -j REDIRECT the traffic to another chain, and forward it from there? Any Ideas or solutions would be most appreciated :) Thanks in advance, Damien Mason -- Best Regards, Damien Mason SuSE Systems Specialist SuSE Linux Asia-Pacific 2-6 Waltham Street Artarmon, NSW 2064, Australia Telephone: (612) 943 943 94 ext 246 Facsimile: (612) 9437 3839 Email: kinetic@suse.net.au Web: http://www.suse.net.au./